What Is New in Kubernetes 1.24
Kubernetes 1.24 delivers significant changes focused on maturing existing features and refining the core experience. The removal of Dockershim is the headline, but numerous enhancements across storage, security, and workload management make this a substantial release.
| Category | Key Changes |
|---|---|
| Major Changes | Dockershim Removed, Beta APIs Disabled by Default |
| New Features | Kubelet CRI API, Storage Capacity Tracking GA, Non-Graceful Node Shutdown GA |
| Improvements | Pod Security Admission, Contextual Logging, Service ClusterIP Allocation |
| Security | CSR Duration Extended, gMSA Support, Seccomp Default |
| Deprecations | PodSecurityPolicy, Service Account Token Automation |
Is Docker support finally gone in Kubernetes 1.24?
Yes, the built-in Dockershim component has been completely removed. You can no longer use Docker Engine as your container runtime through the legacy CRI bridge.
This was a long-planned change. You must migrate to a fully compatible container runtime like containerd or CRI-O. In practice, most production clusters made this switch years ago, so the impact should be minimal for well-maintained environments.
The kubelet now communicates exclusively through the Container Runtime Interface (CRI), which is a cleaner and more efficient architecture. This simplifies maintenance and paves the way for future runtime innovations.
How did Kubernetes 1.24 change Beta API availability?
Beta APIs are now disabled by default starting with this release. This is a significant shift in the API versioning policy to improve stability.
You must explicitly enable beta APIs using the relevant feature gate if you still need them. This change prevents workloads from accidentally relying on APIs that might change in future versions, reducing upgrade surprises.
You should audit your manifests and controllers for any use of beta APIs and migrate them to the stable versions. The API deprecation process is now much more strict and predictable.
What storage improvements arrived in version 1.24?
Two major storage features graduated to General Availability: Storage Capacity Tracking and Non-Graceful Node Shutdown.
Storage Capacity Tracking helps the scheduler make smarter decisions by understanding available storage capacity across nodes before placing pods that require persistent volumes. This reduces the chance of pod scheduling failures due to insufficient storage.
Non-Graceful Node Shutdown allows stateful workloads to recover more reliably when a node fails abruptly instead of being shut down cleanly. The volume manager can now detach volumes from vanished nodes so they can be reattached elsewhere.
How does Pod Security Admission work in this release?
The Pod Security Admission controller reached beta, replacing the deprecated PodSecurityPolicy. This is a simpler, more declarative approach to enforcing pod security standards.
You define security levels (privileged, baseline, restricted) using namespace labels rather than complex policy objects. This makes it easier to apply consistent security profiles across your clusters without the operational overhead of PSP.
The migration from PodSecurityPolicy should be prioritized since PSPs are scheduled for removal in v1.25. The new admission controller integrates cleanly with the Pod Security Standards documentation.
What logging enhancements were introduced?
Contextual logging advanced to beta, providing more structured and contextual log output from Kubernetes components. This makes logs much easier to filter and analyze.
Instead of plain text messages, logs now include structured keys and values that identify the source component and relevant context. This is particularly valuable for debugging complex issues in large clusters where log volume is high.
The klog library now supports JSON output format as an alternative to the traditional text format. This works better with modern log processing pipelines that expect structured data.
FAQ
My cluster still uses Docker Engine - will it break with 1.24?
Yes, it will break. You must migrate to a supported container runtime (containerd, CRI-O) before upgrading. The kubelet will fail to start with Docker Engine.
How do I check if I'm using any beta APIs that will be disabled?
Use kubectl convert to review your manifests or check your audit logs for API requests to beta endpoints. The API server will also log warnings for deprecated API usage.
What's the simplest way to migrate from PodSecurityPolicy to Pod Security Admission?
Start by labeling your namespaces with the appropriate level (e.g., pod-security.kubernetes.io/enforce: baseline). Use audit mode first to see what would be blocked before enforcing.
Can I still use service account token automounting?
The automatic mounting of service account tokens is now configurable per pod specification. You need to explicitly set automountServiceAccountToken: false if you want to disable it, whereas before it was enabled by default.
Did anything change with how Services work?
Yes, Service ClusterIP allocation became more efficient. The system now uses a more intelligent allocator that reduces conflicts and improves performance when managing large numbers of Services.